This is the current version. · Released:
Installer files 0.16.3
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | ZIP → Portable | — | — | github.com | VirusTotal |
| 32-bit | ZIP → Portable | — | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
# pdfcpu v0.16.3
This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.
**Applications handling untrusted PDFs or create/form input should upgrade.**
**Decoded-byte limits — [GHSA-jp42-qm45-2x6g](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-jp42-qm45-2x6g):**
Honor `Limits.MaxDecodeBytes` across stream decoding and combined page content, and stop cross-reference repair after
limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed
validation and eager/deferred decoding.
The limit bounds individual decoded streams and combined page content, not total process memory.
**Additive Go API change:** Add `StreamDict.DecodeWithLimit` and `StreamDict.DecodeLengthWithLimit` to supply the
configured decode limit explicitly.
**Local image access — [GHSA-44h9-p34h-2w4p](https://github.com/pdfcpu/pdfcpu/security/advisories/GHSA-44h9-p34h-2w4p):**
Confine local images referenced by `create`, `form fill`, and JSON/CSV `form multifill` input to an allowed directory.
Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials
as errors.
**Compatibility change:**
API callers must set `conf.LocalImageRoot` to enable local images; an empty value disables
them. The CLI defaults to its working directory; set `localImageRoot` in `config.yml` to select another root.
Update image paths to be relative to that root. Confined local images are unavailable on `js/wasm`.
See [local image access](https://pdfcpu.io/create/create/#local-image-access) for migration guidance and limitations.
**Documentation:**
Updated [security policy](https://github.com/pdfcpu/pdfcpu/blob/v0.16.3/SECURITY.md) clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings.
Updated [pull request template](https://github.com/pdfcpu/pdfcpu/blob/v0.16.3/.github/pull_request_template.md) clarifies contribution requirements.
Added local image configuration and migration guidance to README and website.
Requires Go 1.26 or later, unchanged from v0.16.2.
## Changelog
• * 35ea259eb27d5a607f797edd41fd8a9e50a1f818 bump version
• * 8befe54db401e8ed0ecb9d52aec700fa67b2972f confine local images in create and form input
• * c1db2d55c0826689a129012fbac5a25d5fd3a39f honor configured decode limits across stream consumers
